SkillSpector is a command-line scanner that inspects agent skills for vulnerabilities, malicious patterns, and supply-chain risk before you install them. It accepts a Git repository, a URL, a zip file, a directory, or a single SKILL.md file, and returns a 0-100 risk score with a severity label and one of three recommendations: SAFE, CAUTION, or DONOTINSTALL. It is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs skills before publication.
Detection runs in two stages. Static analysis applies 71 patterns across 17 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system-prompt leakage, memory poisoning, tool misuse, rogue agent, trigger abuse, dangerous code via Python AST, taint tracking, YARA signatures, and MCP least-privilege and tool-poisoning checks. An optional second stage sends file contents to a configured model to judge intent and filter false positives, which the project reports raises precision to about 87 percent. Supply-chain rule SC4 queries OSV.dev for live CVE data and falls back to a bundled list when the API is unreachable.
Model access is configured through SKILLSPECTOR_PROVIDER. Hosted options cover OpenAI and any OpenAI-compatible endpoint, Anthropic directly or through a Vertex-style proxy, AWS Bedrock via SigV4, and build.nvidia.com; local options reuse an authenticated claude or codex CLI session, or a local server such as Ollama, vLLM, or llama.cpp. --no-llm keeps every file local and runs static analysis only.
Beyond the CLI, SkillSpector runs as a Model Context Protocol server exposing a single scanskill tool, so an MCP-capable agent host can gate skill and MCP installs on the verdict; the response reports llmused and scan_mode so a static-only scan is distinguishable from a full one. The HTTP transport ships without authentication and rejects local paths and file:// URLs. Output is available as terminal text, JSON, Markdown, or SARIF 2.1.0, and a baseline file suppresses accepted findings so re-scans surface only new ones.
Ingest limits bound untrusted input: 100 MiB per ingest across URL downloads, uncompressed zip contents, and cloned repositories, 10,000 entries per zip, and a separate 1 MB per-file analysis cap; a breach fails closed. The scanned skill is never executed, and analysis is limited to static inspection plus optional model evaluation of file contents. Documented limitations include non-English content, text inside images, compiled or encrypted code, and runtime behavior.
Features
- Multi-format input: scans Git repositories, URLs, zip archives, directories, and single files
- 71 static patterns: 17 categories spanning prompt injection, exfiltration, supply chain, excessive agency, and MCP misuse
- AST and YARA analysis: Python AST checks for exec, eval, dynamic imports, and subprocess use, plus YARA signatures
- Live CVE lookup: SC4 batches dependency queries to OSV.dev with an offline fallback list
- Optional model stage: semantic evaluation of intent with anti-jailbreak protections in the prompt
- Provider choice: OpenAI, Anthropic, Anthropic proxy, Bedrock, build.nvidia.com, local Claude or Codex CLI sessions, and OpenAI-compatible servers
- MCP server: scanskill returns risk score, severity, recommendation, safeto_install, and findings for install gating
- Output formats: terminal, JSON, Markdown, and SARIF 2.1.0 for CI and IDE tooling
- Baselines: fingerprint or glob rules suppress accepted findings so only new issues are scored
- Batch scanning: a contrib scanner runs directories of skills in parallel with multilingual detection for Chinese, Japanese, and Korean
- Fail-closed limits: 100 MiB per ingest, 10,000 zip members, and a 1 MB per-file analysis cap
- Container use: a bundled Dockerfile runs scans without a local Python installation
